October 2019 - keycloak-dev - Jboss List Archives

by Perot Francis

Hi all, I recently had to start working with Keycloak and, as I’m using a static code analyzer in my IDE (Sonar Lint), I got lots of recommendations about Keycloak code. These recommendations are not always very relevant but can help to increase the code quality, the readability, can help to detect bugs (I actually found some) and this might be an important point for the stability of the product, especially for a product managing authentication. First, in MultiValuedHashMap.equalsIgnoreValueOrder(), there is a bug but it can be considered as assumed if we suppose that it is not possible to have duplicated values in this map (which is often the case). For a given key, if we compare associated lists of 2 MultivaluedHashMap instances [1, 2, 2] and [1, 2, 3], equalsIgnoreValueOrder will return true because lengths are equal and all elements from the first list exist in the second list. Do you think it is necessary to fix this ? Static code analysis revealed issues described in the following examples and show some inconsistencies : In FileTruststoreProviderFactory.init(), if pass is null, we “return” at the beginning of the method… but pass is still compared to null twice after that. Similary, in FreeMarkerUtil.processTemplate(), we set cache=null; then we compare cache to null (if (cache!=null)) Don’t you think it could be better to follow some recommendations ? I could work on this : as it should impact lots of code but maybe you should decide which type of recommendation you want to follow and how you prefer to do this : all changes at once, one PR per type of recommendation, on PR per maven module, … Francis Pérot (about me: I’m currently working on the multi-factor feature and we had a meeting two weeks ago with Marek P. and Peter S. : the left ear you saw was mine 😊) Example 1: byte[] signature = null; try { signature = HMACProvider.sign(buffer.toString().getBytes("UTF-8"), Algorithm.HS512, sharedSecret); } catch (UnsupportedEncodingException e) { throw new RuntimeException(e); } Can become: byte[] signature = HMACProvider.sign(buffer.toString().getBytes(StandardCharsets.UTF_8), Algorithm.HS512, sharedSecret); Example 2: LDAPObject ldapUser = ldapQuery.getFirstResult(); if (ldapUser == null) { return null; } return ldapUser; Can become: return ldapQuery.getFirstResult(); Example 3: if (responderURIs.size() == 0) { if (responderURIs.isEmpty()) { Example 4: Set<Annotation> set = new HashSet<Annotation>(); Set<Annotation> set = new HashSet<>(); Other examples : https://github.com/fperot74/keycloak/pull/1/files

5 years, 1 month

3
4
0 / 0

[KEYCLOAK-11293] Create build for new account console

by Bruno Oliveira

Good afternoon, Alex is working on https://issues.jboss.org/browse/KEYCLOAK-11293 and I would like to double-check if we're ok with the requirements described below. What The new account console needs to be built from Maven. The build also needs to be able to build the RH-SSO version. Why There's no way to build the new account console from Maven and that's a requirement that has an impact on testing and distribution. How - Build the new account console as part of the default distribution (Keycloak and RHSSO build) - The Maven build should be based on the steps described in the README Acceptance Criteria - Have all the artifacts from the new account console in the same Keycloak/RHSSO server distribution Additional information This Jira can also incorporate https://issues.jboss.org/browse/KEYCLOAK-5392 if possible, but that's not mandatory Comments are welcome, in the same Jira or here. -- - abstractj

5 years, 1 month

5
13
0 / 0

Filtering in New Account Console

by Stan Silvert

Specifically, we need to discuss filtering and pagination as it relates to the "Applications" page: https://marvelapp.com/c90dfi0/screen/59942290 The current design allows filtering by name and application type. However, Stian has pointed out that some customers will have thousands of clients. So this design might be unworkable. I don't want to go too far into the weeds right now because I want to understand the problem better first. What is the use case when customers have many, many clients? How common is it to have many, many clients for a single user? What do those clients look like? What could we use to filter on? The information we currently have on the client side looks something like what you see here: https://marvelapp.com/c90dfi0/screen/59942292

5 years, 1 month

6
42
0 / 0

User/ClientSession for Offline Access Management Issue (lost, never recovered and unused one left on DB everlastingly)

by 田畑義之 / TABATA，YOSHIYUKI

Hello, # This is Yoshiyuki Tabata writing on behalf of Takashi Norimatsu. I've used the keycloak (4.8.3.Final) in clustering environment and managed about 500k user sessions for Offline Access. I've encountered the following 2 problems : [Problems] (i) Still valid User/Client Session for Offline Access are lost, meaning lost on the infinispan cache (offlineSessions, offlineClientSessions) of every keycloak node in the cluster. (ii) Such the lost User/Client Session for Offline Access are left on DB everlastingly. As for (i), it seems to be reasonable for ordinal SSO UserSession/ClientSession. However, it seems not to be reasonable for persisted User/Client Session for Offline Access on DB. As for (ii), the size of unused resources on DB seems to increase so that it is the problem. I think such the problems seem to occur in the following clustering environment : [Environment] (a) Infinispan setting owners=1 for offlineSessions and offlineClientSessions At least one keycloak node is down. The actual case has been reported on https://issues.jboss.org/browse/KEYCLOAK-11829. (b) # of keycloak nodes is larger than the value of owners for offlineSessions and offlineClientSessions The keycloak nodes are down more than or equal to the value of owners simultaneously. (c) # of keycloak nodes is equal to the value of owners for offlineSessions and offlineClientSessions & The size of the caches of offlineSessions and offlineClientSessions are bounded. The active User/Client Session for Offline Access is evicted from the Infinispan cache. I think the current workaround of these problems is as follows : * Shut down all keycloak nodes. * Reboot one keycloak node. To do so, rebooted keycloak node recovers all of User/Client Session for Offline Access from DB to infinispan cache. However, as reported on https://issues.jboss.org/browse/KEYCLOAK-11019, downtime tends to be long in the situation that vast number of User/Client Session for Offline Access exist in DB, and it seems not to be acceptable. To get around it, what do you think about the following idea? * If some User/Client Session for Offline Access are searched on the infinispan cache and not found, try to search it on DB. I know it seems to increase disk access, so needs to consider this point. Regards, Yoshiyuki Tabata (On behalf of Takashi Norimatsu) Hitachi, Ltd.

5 years, 1 month

2
1
0 / 0

A newly added Hardcoded Role mapper ignores users that have already logged in before

by EXTERNAL Thiele Frank (TNG, INST-CSS/BSV-OS2)

Hello, In our project, we use the "Hardcoded role" mapper within a configured Identity Provider (also a Keycloak instance, in our case the same but a different realm) to describe that each user logging in via Keycloak shall be given a certain role. This works perfectly if the mapper is configured before the first login of the user. The configured role is granted to the (cloned) user when he logs in the first time via Keycloak. But when another "Hardcoded role" mapper is added to configure another role, then the user is not given the other role when he logs in. Only new users logging in the first time get both roles assigned. Is this on purpose or a bug? Mit freundlichen Grüßen / Best regards Frank Thiele Open Source Services 2 - Product Group Customer Success Services (INST-CSS/BSV-OS2) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com<http://www.bosch-si.com%3chttp:/www.bosch-si.com>> external.Frank.Thiele(a)bosch-si.com<mailto:external.Frank.Thiele@bosch-si.com<mailto:external.Frank.Thiele@bosch-si.com%3cmailto:external.Frank.Thiele@bosch-si.com>> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic

5 years, 1 month

6
32
0 / 0

[Keycloak Operator] Backup and restore

by Sebastian Laskawiec

Hey! Over the last few days I've been investigating different options for performing backup and restore for Keycloak Operator. I've been discussing different parts of this functionality with some of you, and now I'd like to bring everybody on the same page. Grab a large cup of coffee and let's dig in! 1. Old Operator's behavior The Old Keycloak Operator used to use a CronJob to schedule database backup and upload its result into AWS S3 [1]. However, it seems (at least I can not find it) the Operator doesn't perform a restore operation. The biggest advantage of this approach is consistency (across other Operators created by Integreately Team [2]). But there are some downsides are well - it's limited to AWS, it uploads large images across wide open Internet, there's no way to ensure any retention policy (as we just upload the backup and forget about it). 3. Related work There's ongoing work on Persistent Volumes Snapshots [3], which is targeted to Kubernetes 1.16, which is probably OpenShift 4.3+ [4]. The functionality allows us to create a Persistent Volume Snapshot, which could be used as a backup. Later on, we could use such a snapshot to mount it into Postgresql Pod. However, I'm not sure what will happen with the in-flight transactions when we take such a snapshot from Postgresql. Once the snapshot functionality is in, we can test it out. I asked the Storage SIG if there are some plans to create an automatic tool that makes creating backups for the whole cluster a bit easier but I've been told the Storage SIG will create only building blocks (like the snapshots) for it. Nothing more. The Snapshot functionality could be taken one step further and we could imagine creating a backup for whole namespace (with all ConfigMaps, Secrets etc). It seems there's no out of the box tool that does this. The closest is Valero [5] by Heptio/VMware. I've also heard (from my private channels) about companies selling closed-source projects like that. The Persistent Volumes in Kubernetes use Storage Classes [6] to indicate, what underlying storage mechanism to use. Some of them (like GlusterFS or AzureDisk) may natively support backups. Externally configured backups might be tightly connected to budget (e.g. in AWS the slower the disk, the less money you pay for it). 4. An implementation idea with pg_dump I did some experiments with spinning up a new Pod (or a Job), with a brand new Persistent Volume and using gp_dumpall utility for backing up Postgresql [7]. We may also let the user decide on the storage class at this point (e.g. use a slow and cheap storage for backups). The idea is to act when a user creates a KeycloakBackup CR: apiVersion: keycloak.org/v1alpha1 kind: KeycloakBackup metadata: name: example-keycloakbackup spec: # This field will be used for restoring a backup, I will explain it a bit later #restore: true instanceSelector: matchLabels: app: keycloak This triggers an Operator to create a Pod (or a Job) with a new Persistent Volume mounted and use pg_dumpall to create a backup. Once the backup is created, we leave the Persistent Volume in the cluster. Sending it to an external storage would use a user's responsibility. At this point we also don't care about periodic backups. If someone wishes to create them - he needs to create a CronJob that will be creating KeycloakBackups on his behalf (here's a link showing how to call Kubernetes API from a Job/Pod [8]). Once a user decides to restore a backup, he just sets the restore flag to `true`. Then the CR is in its terminal state - you can't do anything with a restored backup. This solution has some advantages - it creates a nice 1:1 mapping between a CR and a backup. It also maintains this mapping with each restore. Finally, we don't need to care about retention policy or scheduled backups - it's users (or K8s admin) responsibility to do that. We just create an additional Persistent Volume that contains a database backup. Of course, lack of retention policy and scheduling might be considered as a drawback - it's a valid point of view. 5. Integreately Team requirements @David Martin <davmarti(a)redhat.com> sent me a set of requirements for the Keycloak Operator around backups: - The operator can do backups (scheduled and manually triggered) - The backup process should push resources offsite. Otherwise I have to code that bit. If it doesn't do this, why bother with any backup logic at all - The operator should make the configuration of this as easy as possible e.g. allow a schedule to be configured, and a location/credentials to push - The operator should make a restore easy to do e.g. point to offsite location & credentials - Not directly related to this thread, but mentioning it for the larger picture. Problems with the backup should trigger an alert in Prometheus.. 6. Final thoughts Unfortunately there's no ultimate solution for backing up the whole namespace yet. We are at the point where all necessary building blocks are being built as we speak (like Persistent Volume Snapshots). But we're months if not years from the final solution. I like the idea of backups I explained in #4. I believe it's very extensible but it doesn't fulfill most of the requirements from David's list. However, we could do a few tricks to make the situation a bit better: - we might implement a CronJob that will be creating KeycloakBackup according to the given schedule. - we might reuse (or slightly modify) the Integreately upload utility to support Persistent Voluments that already contain a backup. In other words - the utility will need to skip the pg_dump call. Alternatively - we may take the path of least resistance and implement backups the same way as in other Operators but separating the implementation with a clean and nice interface (so that we could extend it in the future). Thanks, Sebastian [1] https://github.com/integr8ly/keycloak-operator/blob/d4aa7f0fdcf765b578ed1... [2] https://github.com/search?q=integreatly%2Fbackup-container&type=Code [3] https://kubernetes-csi.github.io/docs/snapshot-restore-feature.html [4] https://blog.openshift.com/wp-content/uploads/Red-Hat-OpenShift-4.0-Roadm... [5] https://velero.io/ [6] https://kubernetes.io/docs/concepts/storage/storage-classes/#the-storagec... [7] https://github.com/slaskawi/keycloak-operator/blob/INTLY-3367-Backups/bac... [8] https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#w...

5 years, 1 month

2
2
0 / 0

[keycloak-gatekeeper] Add resource filter to allow specific users

by Niels Denissen

Hi, In a project I’m working on we need to restrict access to a certain resource (URL) to a single person only. We’re using keycloak-gatekeeper in front of this resource to restrict access. As far as I understand, in order to achieve this in the current architecture, this would involve creating a new group for each separate user and in keycloak-gatekeeper add this group to the list of allowed groups for this resource. As this involves creating a group for each user (lots of overhead), I envisioned a new filter in the keycloak-gatekeeper project for resources based on `AllowedUsers` (next to the existing ones for e.g. roles and groups). This would allow us to specify for any given resource, the user that is allowed access to it specifically. I’ve created some initial code for this in a fork (https://github.com/nielsdenissen/keycloak-gatekeeper/commit/5ed6ddf2e5714... <https://github.com/nielsdenissen/keycloak-gatekeeper/commit/5ed6ddf2e5714...>) and am looking for some feedback of the community to see if I missed any other way to solve this problem and whether such a feature seems interesting to others as well. Any help is appreciated! Thanks, Niels

5 years, 1 month

2
4
0 / 0

Silent Re-authentication using ID Token

by Pedro Igor Silva

Hi, I would like to confirm that we don't support the `id_token_hint` authorization request parameter. When in conjunction with `prompt=none` it is useful to re-authenticate as well as check whether or not the session associated with the token is active through a non-authenticated request (e.g.: no cookies set by the OP). The use case I'm trying to solve is based on the assumption that you only have/keep the ID Token, you don't want a front/back channel for logout (e.g.: app is stateless), you need to check whether or not session is active, and the check is done through a backchannel communication between the application and the OP. Spec-wise, using either user-info or introspection endpoint is not possible if you only have the ID Token (although some implementations like Google provide an addition `id_token_hint` to the introspection endpoint) given that you should use the access token as a bearer. Wdyt ? Regards. Pedro Igor

5 years, 1 month

2
4
0 / 0

test - please ignore

by Stan Silvert

test

5 years, 2 months

1
0
0 / 0

New Navigation Design Proposal for Admin Console

by Haley Wang

Hi team, We did a user testing on the admin console navigation earlier this month (mainly focus on the realm switch design). Here is the new proposal based on the feedback: https://marvelapp.com/7gb4j6h The new design is supposed to satisfy two use cases: - Most users have no more than 5 realms - Few users have hundreds or thousands of realms We would love feedback on the proposal. Thanks -- Haley Wang Interaction Designer, User Experience Design T: 838-9406 <https://www.redhat.com/>

5 years, 2 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev October 2019